Supplier monitoring
A supplier assessment is accurate on the day it is signed. Our supplier monitoring keeps it accurate afterwards, combining automated checks with, on our managed service, review by your data protection officer, so the evidence behind your risk assessments stays current.
Each layer builds on the one below. The last is the one software cannot do.
The problem
Under Article 28 of the UK GDPR you may use only processors that provide sufficient guarantees, and under Article 5(2) you must be able to show it. Most organisations assess a supplier once, at procurement, and then hear nothing until renewal.
They add sub-processors, move hosting, change their data processing terms or let a certification lapse, often with only a notice on their website.
Certificates expire, email protections are weakened, and old services are left exposed. None of it shows up in a questionnaire answered last year.
Automated security ratings flag issues, but they cannot tell you whether a finding matters for the data you share with that supplier.
Our approach
Automated monitoring and expert review usually come from different places. With our managed service, we put them together, so every change we detect is read by someone who knows your processing and can tell you what it means.
Every day
Every week
Every day
Whenever something changes, on the managed service
What you receive
With our managed service, you will not be asked to make sense of a security score on your own. When a supplier changes something that matters, you hear from us with what changed, whether it affects your data and what, if anything, you should do.
Behind each piece of advice sits a dated scan and a published scoring method, so the evidence stands up if your assessments are ever questioned by a regulator, an auditor or a parent.
The supplier’s published sub-processor list now includes an AI provider processing data in the United States.
This affects the DPIA we hold for you. We recommend that you confirm whether the feature is enabled for your account. We have drafted the questions for the supplier and will update the assessment once they reply.
Illustrative example
How it works for you
Suppliers are grouped into portfolios such as EdTech, Finance or General. Platforms that many of our clients use are monitored once and shared, so you benefit from coverage of your sector from day one.
Niche or specialist suppliers can sit in a private portfolio that only you and we can see.
With your consent, we monitor your own domain in the same way, so you can see what an attacker, an insurer or a customer doing due diligence sees. Unlike supplier results, you see your own score and the findings behind it, and on the managed service we tell you what to fix first. It is included in your retainer, and the portal-only subscription covers up to five of your own domains.
Mark each supplier as in use, under assessment or no longer used, and your own list sits at the top of the page. A supplier under assessment prompts the question of whether a DPIA is needed; one you have stopped using prompts you to confirm your data has been returned or deleted.
Your Article 30 record of processing lives in the same portal, starting from a template for schools or businesses. Each activity links to the suppliers it uses, so their security evidence comes straight from our monitoring, and gaps such as a missing lawful basis or retention period are highlighted. On the managed service we review each entry, and you can download it as a PDF or spreadsheet.
Each DPIA records the scan it relied on. When a later scan finds a material change, the DPIA is flagged for review automatically.
Our scanner collects only what suppliers make publicly available and never tests logins or exploits weaknesses. Suppliers can see exactly how it works on our scanner page.
Two ways to use it
Supplier monitoring is part of the GDS client portal. You can have it as part of our managed data protection service, or as part of a portal-only subscription run by your own team.
| Feature | Managed service | Portal only |
|---|---|---|
| Daily checks, including ICO and Companies House | Yes | Yes |
| Your own domains, supplier statuses and record of processing | Yes | Yes, up to five of your own domains |
| GDS review of results, advice and DPIA updates | Yes | No, results are automated |
| Price | Included in your DPO retainer | Ask about pricing |
| Move between them | Yes, at any time | Yes, at any time |
The portal-only subscription is provided under our Terms of Service. See also the service description and our Security Statement.
Questions
Yes. Your suppliers, statuses and records stay in the portal when you move from the portal-only subscription to the managed service, and from then on our DPO reviews your results and keeps your DPIAs up to date.
Not for managed service clients: supplier monitoring is included in your DPO retainer. For organisations that run the portal themselves, it is part of the portal-only subscription. Ask us about pricing.
No. It sees what a supplier exposes to the internet and what it publishes, not its internal controls. It tells you when to ask questions, and our DPIAs still include the questions that only the supplier can answer.
Yes, if they look. Our scanner identifies itself and links to a public page explaining what it does, how to correct a finding and how to contact us. Nothing about the monitoring is hidden.
No. Results are shared only with clients who use the supplier concerned. Managed service clients see them after our review: when a later scan finds nothing material has changed, it is published under our latest review, and anything material waits for us. Portal-only subscribers see the automated assessment, clearly labelled as not reviewed by GDS. Where we publish a summary assessment, it contains our commentary and the date, never a score.
Any supplier with its own internet domain. Tell us which suppliers process your personal data and we will add any that are not already monitored. We already monitor more than 300 widely used services, including the main platforms used by schools and businesses.
Book a call and we will talk you through how monitoring works with your existing DPIAs and the suppliers you rely on most.
© 2026 GDS Analytics. All rights reserved.